feat: HTTPS web frontend (self-signed) + server-side token endpoint

- nginx serves the UI over HTTPS on 8090 with a self-signed cert
  (browsers require a secure context for microphone access)
- added /token endpoint (tiny Python HTTP server) that signs LiveKit
  JWTs server-side, keeping the API secret out of the browser
- app.js now fetches a signed token from /token and uses wss:// when
  the page is served over HTTPS
- supervisord runs the token-server as a fourth process

supervisord.conf

@@ -36,3 +36,14 @@ autostart=true
 autorestart=true
 stdout_logfile=/var/log/supervisor/web.log
 stderr_logfile=/var/log/supervisor/web_err.log
+
+[program:token-server]
+command=/opt/voice-agent/.venv/bin/python /opt/voice/token_server.py
+user=voiceuser
+autostart=true
+autorestart=true
+stdout_logfile=/var/log/supervisor/token.log
+stderr_logfile=/var/log/supervisor/token_err.log
+environment=
+    LIVEKIT_API_KEY="%(ENV_LIVEKIT_API_KEY)s",
+    LIVEKIT_API_SECRET="%(ENV_LIVEKIT_API_SECRET)s"